denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-crypto: Simplify and extend cipher config filter

Browse Source 
This way we automatically can filter for newer algorithms (e.g.
chacha20poly1305).
This commit is contained in:
Tobias Brunner
2021-02-12 14:35:23 +01:00
parent 8b2b5a647b
commit 74b9ba7cdb
1 changed files with 6 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_crypto.c
+6 -44
View File
@@ -966,50 +966,12 @@ static void filter_cipher_config_suites(private_tls_crypto_t *this,
enumerator = enumerator_create_token(config, ",", " "); enumerator = enumerator_create_token(config, ",", " ");
while (enumerator->enumerate(enumerator, &token)) while (enumerator->enumerate(enumerator, &token))
{ {
if (strcaseeq(token, "aes128") && const proposal_token_t *tok;
suites[i].encr == ENCR_AES_CBC &&
suites[i].encr_size == 16) tok = lib->proposal->get_token(lib->proposal, token);
{ if (tok != NULL && tok->type == ENCRYPTION_ALGORITHM &&
suites[remaining++] = suites[i]; suites[i].encr == tok->algorithm &&
break; (!tok->keysize || suites[i].encr_size == tok->keysize / 8))
}
if (strcaseeq(token, "aes256") &&
suites[i].encr == ENCR_AES_CBC &&
suites[i].encr_size == 32)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "aes128gcm") &&
suites[i].encr == ENCR_AES_GCM_ICV16 &&
suites[i].encr_size == 16)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "aes256gcm") &&
suites[i].encr == ENCR_AES_GCM_ICV16 &&
suites[i].encr_size == 32)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "camellia128") &&
suites[i].encr == ENCR_CAMELLIA_CBC &&
suites[i].encr_size == 16)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "camellia256") &&
suites[i].encr == ENCR_CAMELLIA_CBC &&
suites[i].encr_size == 32)
{
suites[remaining++] = suites[i];
break;
}
if (strcaseeq(token, "null") &&
suites[i].encr == ENCR_NULL)
{ {
suites[remaining++] = suites[i]; suites[remaining++] = suites[i];
break; break;